<security-notice xmlns="http://qemu.org/xmlns/security-notice/1.0">
  <id>2018-003</id>

  <summary>Multiboot out of bounds loading kernel</summary>

  <description>
<![CDATA[Quick Emulator(QEMU) built with the PC System Emulator with multiboot feature
support is vulnerable to an OOB memory access issue. It could occur while
loading a kernel image during a guest boot if multiboot head addresses
mh_load_end_addr was greater than mh_bss_end_addr.]]>
  </description>

  <impact>
<![CDATA[A user/process could use this flaw to potentially achieve arbitrary code
execution on a host.]]>
  </impact>

  <mitigation>
<![CDATA[Do not use the -kernel argument to QEMU for providing the boot kernel.
Allow the guest firmware and bootloader (eg grub) to load the boot kernel from
inside the confined guest execution environment]]>
  </mitigation>

  <credits>
    <reporter>
      <name></name>
      <email></email>
    </reporter>
    <patcher>
      <name></name>
      <email></email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20180221</reported>
    <published>20180227</published>
    <fixed>20180328</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2018-7550"/>
  </reference>

  <repository>
    <branch>
      <name>master</name>
      <tag state="fixed">v2.12.0</tag>
      <change state="fixed">2a8fcd119eb7c6bb3837fc3669eb1b2dfb31daf8</change>
      <change state="merged">854a4436dd313eaeb51c275d00526d60437915d2</change>
      <tag state="vulnerable">v1.0</tag>
      <tag state="vulnerable">v1.1.0</tag>
      <tag state="vulnerable">v1.2.0</tag>
      <tag state="vulnerable">v1.3.0</tag>
      <tag state="vulnerable">v1.4.0</tag>
      <tag state="vulnerable">v1.5.0</tag>
      <tag state="vulnerable">v1.6.0</tag>
      <tag state="vulnerable">v1.7.0</tag>
      <tag state="vulnerable">v2.0.0</tag>
      <tag state="vulnerable">v2.1.0</tag>
      <tag state="vulnerable">v2.2.0</tag>
      <tag state="vulnerable">v2.3.0</tag>
      <tag state="vulnerable">v2.4.0</tag>
      <tag state="vulnerable">v2.5.0</tag>
      <tag state="vulnerable">v2.6.0</tag>
      <tag state="vulnerable">v2.7.0</tag>
      <tag state="vulnerable">v2.8.0</tag>
      <tag state="vulnerable">v2.9.0</tag>
      <tag state="vulnerable">v2.10.0</tag>
      <tag state="vulnerable">v2.11.0</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.0</name>
      <tag state="vulnerable">v1.0.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.1</name>
      <tag state="vulnerable">v1.1.1</tag>
      <tag state="vulnerable">v1.1.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.2</name>
      <tag state="vulnerable">v1.2.1</tag>
      <tag state="vulnerable">v1.2.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.3</name>
      <tag state="vulnerable">v1.3.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.4</name>
      <tag state="vulnerable">v1.4.1</tag>
      <tag state="vulnerable">v1.4.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.5</name>
      <tag state="vulnerable">v1.5.1</tag>
      <tag state="vulnerable">v1.5.2</tag>
      <tag state="vulnerable">v1.5.3</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.6</name>
      <tag state="vulnerable">v1.6.1</tag>
      <tag state="vulnerable">v1.6.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-1.7</name>
      <tag state="vulnerable">v1.7.1</tag>
      <tag state="vulnerable">v1.7.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.0</name>
      <tag state="vulnerable">v2.0.1</tag>
      <tag state="vulnerable">v2.0.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.1</name>
      <tag state="vulnerable">v2.1.1</tag>
      <tag state="vulnerable">v2.1.2</tag>
      <tag state="vulnerable">v2.1.3</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.2</name>
      <tag state="vulnerable">v2.2.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.3</name>
      <tag state="vulnerable">v2.3.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.4</name>
      <tag state="vulnerable">v2.4.0.1</tag>
      <tag state="vulnerable">v2.4.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.5</name>
      <tag state="vulnerable">v2.5.1</tag>
      <tag state="vulnerable">v2.5.1.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.6</name>
      <tag state="vulnerable">v2.6.1</tag>
      <tag state="vulnerable">v2.6.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.7</name>
      <tag state="vulnerable">v2.7.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.8</name>
      <tag state="vulnerable">v2.8.1</tag>
      <tag state="vulnerable">v2.8.1.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.9</name>
      <tag state="vulnerable">v2.9.1</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.10</name>
      <tag state="vulnerable">v2.10.1</tag>
      <tag state="vulnerable">v2.10.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
    <branch>
      <name>stable-2.11</name>
      <tag state="vulnerable">v2.11.1</tag>
      <tag state="vulnerable">v2.11.2</tag>
      <change state="vulnerable">6b8273a1b97876950d91c228a420a851e10e12bb</change>
    </branch>
  </repository>

</security-notice>
